Lockean

Lockean is a ransomware affiliate group tracked by CERT-FR. Over roughly 18 months, it compromised at least eight French companies, stole data, and deployed malware from multiple ransomware-as-a-service operations. CERT-FR first observed the group in 2020 in an attack on a French manufacturing company using DoppelPaymer; subsequent intrusions involved Maze, Egregor, ProLock, and REvil. Reported victims included Gefco, Ouest-France, Fareva, and Pierre Fabre, with four additional French victims not publicly named. Lockean operated as a multi-RaaS affiliate and used double extortion, stealing victim data before encryption. CERT-FR reported that the group typically kept 70% of paid ransom proceeds, with the remainder going to the RaaS operators. For initial access, Lockean most commonly relied on Qbot/QakBot, which was delivered via Emotet before its takedown and later via TA551; in at least one case, Lockean used IcedID. During intrusions, Lockean used Cobalt Strike for lateral movement and also employed Adfind, BloodHound, BITSadmin, and Rclone, including Rclone for data exfiltration. CERT-FR also identified TA551 as a collaborator in Lockean operations, helping affiliates deploy ProLock, Egregor, and DoppelPaymer on systems infected with Qbot/QakBot. External analysis cited in the reporting found indicators related to Conti infrastructure, suggesting possible additional RaaS affiliations, but the confirmed reporting in the content identifies Lockean primarily as a ransomware affiliate group active against French organizations.